diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index cfee89e..754e65d 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,4 +1,8 @@
-image: metacpan/metacpan-api
+# The build needs root, for apt-get, and a perl with cpanm. metacpan/metacpan-api
+# used to provide both, but it runs as an unprivileged user now, where apt-get
+# fails with "Permission denied" and cmake never gets installed. Pinned to the
+# distribution as well, so that an upstream rebuild cannot move rocksdb under us.
+image: perl:5.40-trixie
 
 variables:
   # Set `CCACHE_BASEDIR` and `CCACHE_DIR` to point `ccache` towards the cached
@@ -20,8 +24,10 @@
 build-and-test:
   stage: build
   cache:
-    # Cache is shared between branches, but has a unique cache per job.
-    key: derekovecs
+    # Cache is shared between branches, but has a unique cache per job. The
+    # image is part of the key: perl5/ holds what cpanm decided was missing in
+    # that image, so a cache from another one is incomplete.
+    key: derekovecs-perl-5.40-trixie
     paths:
       # Note: directories should align with `$APT_CACHE_DIR` and `$CCACHE_DIR`.
       - apt-cache/
@@ -36,6 +42,9 @@
     - apt-get update && apt-get -o dir::cache::archives="$APT_CACHE_DIR" -y install ccache cmake librocksdb-dev libgflags-dev libsnappy-dev zlib1g-dev libbz2-dev liblz4-dev libzstd-dev libomp-dev
     # ccache only makes the build faster, it must never be able to make it fail,
     # so everything that uses it is guarded and CCACHE_OPTS stays empty without it
+    # a failed package install used to show up much later as "cmake: command
+    # not found" in the middle of the collocatordb build
+    - command -v cmake > /dev/null || { echo "cmake is missing, the package installation did not work"; exit 1; }
     - if CCACHE=$(command -v ccache); then ln -sf "$CCACHE" /usr/local/sbin/gcc && ln -sf "$CCACHE" /usr/local/sbin/g++ && CCACHE_OPTS="-DCMAKE_C_COMPILER_LAUNCHER=ccache -DCMAKE_CXX_COMPILER_LAUNCHER=ccache"; else echo "ccache is not available - building without it"; CCACHE_OPTS=""; fi
     - end_section install_linux_packages
 
@@ -67,6 +76,8 @@
     - end_section build_derekovecs-server
 
     - start_section run_derekovecs-server "Testing DeReKoVecs server"
+    # the server test starts morbo, which cpanm installed into the local lib
+    - export PATH="$CI_PROJECT_DIR/perl5/bin:$PATH"
     - prove --verbose t
     - end_section run_derekovecs-server